On 08/22/2018 03:59 PM, Rick Stevens wrote:
On 08/22/2018 03:47 PM, ToddAndMargo wrote:
Hi All,
My iptables firewall ported from RHEL won't connect to ftp sites and throws this error (written by me years ago):
WARNING: active FTP rules have been selected but one or more necessary modules have not been detected
In /etc/sysconfig/iptables-config, you must add ip_nat_ftp and ip_conntrack_ftp to IPTABLES_MODULES. Delimiter is a space. For example: IPTABLES_MODULES=ip_nat_ftp ip_conntrack_ftp
To load changes, use: # /etc/rc.d/init.d/iptables restart # systemctl restart iptables
To check if modules are loaded, use lsmod
- is Fedora doing FTP differently in iptables?
No, but Fedora, by defaults, locks down the network a lot more than older RHEL systems. If you're using Network Manager, you can use it to open the FTP ports necessary on your machine. Or you can edit the /etc/sysconfig/iptables-config file and add those modules
- where do I find
ip_nat_ftp ip_conntrack_ftp> now a days?
They're included in the kernel RPM. If you must know, they're located in:
/lib/modules/`uname -r`/kernel/net/netfilter
I am finding these inserted:
# lsmod | grep ftp nf_nat_ftp 16384 0 nf_conntrack_ftp 20480 1 nf_nat_ftp nf_nat 36864 3 nf_nat_masquerade_ipv4,nf_nat_ftp,nf_nat_ipv4 nf_conntrack 147456 9 xt_conntrack,nf_nat_masquerade_ipv4,nf_conntrack_ipv4,nf_nat,nf_nat_ftp,ipt_MASQUERADE,nf_nat_ipv4,xt_helper,nf_conntrack_ftp
Is this adequate?
So I do not have to dnf the filters. Simpler.
# ls /lib/modules/`uname -r`/kernel/net/netfilter | grep -i ftp nf_conntrack_ftp.ko.xz nf_conntrack_tftp.ko.xz nf_nat_ftp.ko.xz nf_nat_tftp.ko.xz
And the ones I use to use (ip_nat_ftp, ip_conntrack_ftp) are not showing up. Does Fedora even require these any more?
Here is the error I am getting from iptables:
Aug 22 16:12:09 rn6 kernel: dsl-out Everything Else IN= OUT=eno2 SRC=192.168.xxx.yyy DST=208.106.xxx.yyy LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=25991 DF PROTO=TCP SPT=59698 DPT=21023 WINDOW=29200 RES=0x00 SYN URGP=0
Which means ftp it trying to establish high ports, which is what it is suppose to do. The problem is that I am not tracking them, as I should. "ip_conntrack_ftp" use to do this.
What am I missing?
-T